# Check Email Auth

> Full SPF/DKIM/DMARC/BIMI inspection

**Endpoint:** `POST /v1/checks/email-auth`  
**Access:** Public (no credentials needed)  
**MCP tool:** `check_email_security`

Queries the domain's authoritative nameservers (sees changes within seconds), DNS-over-HTTPS fallback. Findings are plain English with exact fixes.

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/v1/checks/email-auth" \
  -H "Content-Type: application/json" \
  -d '{
    "dkim_selectors": [
      "string"
    ],
    "domain": "acme.com"
  }'
```

## Request body

| Field | Type | Description |
|---|---|---|
| `dkim_selectors` | `string[]` | Extra DKIM selectors to check (common ones are probed). |
| `domain` *(required)* | `string` | A domain, URL or email address. |

```json
{
  "dkim_selectors": [
    "string"
  ],
  "domain": "acme.com"
}
```

## Responses

### 200 OK

Inspection report.

```json
{
  "bimi": {
    "authority_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "findings": [],
    "logo_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "record": "string",
    "status": "pass"
  },
  "checked_at": "2026-10-31T12:00:00Z",
  "dkim": {
    "findings": [],
    "selectors": [],
    "status": "pass"
  },
  "dmarc": {
    "findings": [],
    "inherited_from": "string",
    "pct": 1,
    "policy": "none",
    "record": "string",
    "rollout_stage": "missing",
    "rua": [],
    "status": "pass",
    "subdomain_policy": "none"
  },
  "domain": "acme.com",
  "findings": [
    {
      "area": "mx",
      "detail": "string",
      "fix": {
        "host": "string",
        "note": "string",
        "type": "string",
        "value": "string"
      },
      "id": "0192a5e0-1234-7000-8000-000000000001",
      "severity": "info",
      "technical": "string",
      "title": "string"
    }
  ],
  "mx": {
    "provider": {
      "id": "0192a5e0-1234-7000-8000-000000000001",
      "name": "Acme Inc."
    },
    "records": [],
    "status": "pass"
  },
  "resolver": "authoritative",
  "score": {
    "passed": 1,
    "status": "ready",
    "total": 1
  },
  "spf": {
    "all": "string",
    "findings": [],
    "lookups": 1,
    "record": "string",
    "status": "pass"
  }
}
```

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```